From c34233e5f26343d804e8563a54fa1b73f018696f Mon Sep 17 00:00:00 2001 From: Daniel Gustafsson Date: Mon, 13 Jul 2026 15:08:20 +0200 Subject: [PATCH v3 4/4] ssl: Use the correct feature macros for TLS protocol support Our test for if the underlying TLS library supported a specific version tested against the TLSX_Y_VERSION set of macros. These are however always defined, regardless of if the library was built without support for the specific protocol version. Fix by using the feature test macros OPENSSL_NO_TLSX_Y which are intended for this usecase. The previous coding held no risk of protocol downgrade against the underlying library, a library not supporting the protocol version selected would simply error out as the feature isn't available. This can be easily verified using a modern version of LibreSSL, which in version 3.8 disabled TLS1 and 1.1 by default. Once we bump our minimum supported version of LibreSSL to 3.8+ we can add a test for this. Author: Daniel Gustafsson Reviewed-by: Tristan Partin Reviewed-by: Andreas Karlsson Discussion: https://postgr.es/m/68B9881D-DAA8-467D-A251-C96E98E57BA0@yesql.se --- src/backend/libpq/be-secure-openssl.c | 10 +++++++--- src/interfaces/libpq/fe-secure-openssl.c | 8 +++++--- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c index 00d7519957d..aaea6bedfca 100644 --- a/src/backend/libpq/be-secure-openssl.c +++ b/src/backend/libpq/be-secure-openssl.c @@ -2421,21 +2421,25 @@ ssl_protocol_version_to_openssl(int v) case PG_TLS_ANY: return 0; case PG_TLS1_VERSION: +#ifndef OPENSSL_NO_TLS1 return TLS1_VERSION; +#else + break; +#endif case PG_TLS1_1_VERSION: -#ifdef TLS1_1_VERSION +#ifndef OPENSSL_NO_TLS1_1 return TLS1_1_VERSION; #else break; #endif case PG_TLS1_2_VERSION: -#ifdef TLS1_2_VERSION +#ifndef OPENSSL_NO_TLS1_2 return TLS1_2_VERSION; #else break; #endif case PG_TLS1_3_VERSION: -#ifdef TLS1_3_VERSION +#ifdef OPENSSL_NO_TLS1_3 return TLS1_3_VERSION; #else break; diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c index de65486d204..91c1fa9bb95 100644 --- a/src/interfaces/libpq/fe-secure-openssl.c +++ b/src/interfaces/libpq/fe-secure-openssl.c @@ -1991,20 +1991,22 @@ PQssl_passwd_cb(char *buf, int size, int rwflag, void *userdata) static int ssl_protocol_version_to_openssl(const char *protocol) { +#ifndef OPENSSL_NO_TLS1 if (pg_strcasecmp("TLSv1", protocol) == 0) return TLS1_VERSION; +#endif -#ifdef TLS1_1_VERSION +#ifndef OPENSSL_NO_TLS1_1 if (pg_strcasecmp("TLSv1.1", protocol) == 0) return TLS1_1_VERSION; #endif -#ifdef TLS1_2_VERSION +#ifndef OPENSSL_NO_TLS1_2 if (pg_strcasecmp("TLSv1.2", protocol) == 0) return TLS1_2_VERSION; #endif -#ifdef TLS1_3_VERSION +#ifndef OPENSSL_NO_TLS1_3 if (pg_strcasecmp("TLSv1.3", protocol) == 0) return TLS1_3_VERSION; #endif -- 2.39.3 (Apple Git-146)